Changeset - dc7e37ec3dfd
[Not reviewed]
default
0 2 0
domruf - 8 years ago 2017-11-23 22:16:34
dominikruf@gmail.com
Grafted from: ebaf649bc81e
auth: users_and_groups_data should not be available for anonymous/default user
2 files changed with 5 insertions and 2 deletions:
0 comments (0 inline, 0 general)
kallithea/controllers/home.py
Show inline comments
 
@@ -124,49 +124,49 @@ class HomeController(BaseController):
 
        _closed_branches = repo.closed_branches.items()
 
        if _closed_branches:
 
            res.append({
 
                'text': _('Closed Branches'),
 
                'children': [{'id': rev, 'text': name, 'type': 'closed-branch'} for name, rev in _closed_branches]
 
            })
 
        _tags = repo.tags.items()
 
        if _tags:
 
            res.append({
 
                'text': _('Tag'),
 
                'children': [{'id': rev, 'text': name, 'type': 'tag'} for name, rev in _tags]
 
            })
 
        _bookmarks = repo.bookmarks.items()
 
        if _bookmarks:
 
            res.append({
 
                'text': _('Bookmark'),
 
                'children': [{'id': rev, 'text': name, 'type': 'book'} for name, rev in _bookmarks]
 
            })
 
        data = {
 
            'more': False,
 
            'results': res
 
        }
 
        return data
 

	
 
    @LoginRequired(allow_default_user=True)
 
    @LoginRequired()
 
    @jsonify
 
    def users_and_groups_data(self):
 
        """
 
        Returns 'results' with a list of users and user groups.
 

	
 
        You can either use the 'key' GET parameter to get a user by providing
 
        the exact user key or you can use the 'query' parameter to
 
        search for users by user key, first name and last name.
 
        'types' defaults to just 'users' but can be set to 'users,groups' to
 
        get both users and groups.
 
        No more than 500 results (of each kind) will be returned.
 
        """
 
        types = request.GET.get('types', 'users').split(',')
 
        key = request.GET.get('key', '')
 
        query = request.GET.get('query', '')
 
        results = []
 
        if 'users' in types:
 
            user_list = []
 
            if key:
 
                u = User.get_by_username(key)
 
                if u:
 
                    user_list = [u]
 
            elif query:
 
                user_list = User.query() \
kallithea/tests/functional/test_home.py
Show inline comments
 
@@ -45,41 +45,44 @@ class TestHomeController(TestController)
 
                                        action='index', repo_name=HG_REPO),
 
                                        status=302)
 
            assert 'login' in response.location
 

	
 
    def test_index_with_anonymous_access_disabled(self):
 
        with fixture.anon_access(False):
 
            response = self.app.get(url(controller='home', action='index'),
 
                                    status=302)
 
            assert 'login' in response.location
 

	
 
    def test_index_page_on_groups(self):
 
        self.log_user()
 
        gr = fixture.create_repo_group(u'gr1')
 
        fixture.create_repo(name=u'gr1/repo_in_group', repo_group=gr)
 
        response = self.app.get(url('repos_group_home', group_name=u'gr1'))
 

	
 
        try:
 
            response.mustcontain(u"gr1/repo_in_group")
 
        finally:
 
            RepoModel().delete(u'gr1/repo_in_group')
 
            RepoGroupModel().delete(repo_group=u'gr1', force_delete=True)
 
            Session().commit()
 

	
 
    def test_users_and_groups_data(self):
 
        self.log_user()
 
        fixture.create_user('evil', firstname=u'D\'o\'ct"o"r', lastname=u'Évíl')
 
        fixture.create_user_group(u'grrrr', user_group_description=u"Groüp")
 
        response = self.app.get(url('users_and_groups_data', query=u'evi'))
 
        assert response.status_code == 302
 
        assert url('login_home') in response.location
 
        self.log_user(TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
 
        response = self.app.get(url('users_and_groups_data', query=u'evi'))
 
        result = json.loads(response.body)['results']
 
        assert result[0].get('fname') == u'D\'o\'ct"o"r'
 
        assert result[0].get('lname') == u'Évíl'
 
        response = self.app.get(url('users_and_groups_data', key=u'evil'))
 
        result = json.loads(response.body)['results']
 
        assert result[0].get('fname') == u'D\'o\'ct"o"r'
 
        assert result[0].get('lname') == u'Évíl'
 
        response = self.app.get(url('users_and_groups_data', query=u'rrrr'))
 
        result = json.loads(response.body)['results']
 
        assert not result
 
        response = self.app.get(url('users_and_groups_data', types='users,groups', query=u'rrrr'))
 
        result = json.loads(response.body)['results']
 
        assert result[0].get('grname') == u'grrrr'
0 comments (0 inline, 0 general)